CVE-2025-13109 affects the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, specifically all versions up to and including 1.3.7.2. The vulnerability arises from an insecure direct object reference caused by missing validation on a user-controlled key in the "woof_add_query" and "woof_remove_query" functions. Authenticated users with subscriber-level privileges or higher can exploit this to manipulate saved search queries in other users' profiles, including those of administrators, potentially altering application behavior or user experience. The CVSS 3.1 score is 4.3 (medium severity), reflecting low complexity and limited impact on confidentiality but with integrity implications. There is no indication of known exploits or vendor patches at this time.

An attacker with subscriber-level access or higher can insert or remove arbitrary saved search queries in any user's profile, including administrators. This could lead to unauthorized modification of user-specific data within the plugin, potentially affecting application behavior or user experience. There is no direct impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only. Monitor for updates from the vendor realmag777 regarding patches or official mitigations for this vulnerability.